nuclei-templates/exposed-panels/public-tomcat-manager.yaml

id: public-tomcat-manager

info:
  name: tomcat manager disclosure
  author: Ahmed Sherif & geeknik
  severity: info

requests:
  - method: GET
    path:
      - '{{BaseURL}}/manager/html'
      - '{{BaseURL}}/host-manager/html'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - Apache Tomcat
      - type: status
        status:
          - 401
          - 200
        condition: or
Update and rename public-tomcat-instance.yaml to public-tomcat-manager.yaml Updating the name to better reflect what we're looking for. Updating the status matcher since some Tomcat manager instances don't require auth. 2021-01-13 23:28:48 +00:00			`id: public-tomcat-manager`
add tomcat manager disclosure (authenticated) 2020-06-18 02:27:31 +00:00
			`info:`
			`name: tomcat manager disclosure`
Update and rename public-tomcat-instance.yaml to public-tomcat-manager.yaml Updating the name to better reflect what we're looking for. Updating the status matcher since some Tomcat manager instances don't require auth. 2021-01-13 23:28:48 +00:00			`author: Ahmed Sherif & geeknik`
uniform severity update 2020-08-03 21:52:00 +00:00			`severity: info`
add tomcat manager disclosure (authenticated) 2020-06-18 02:27:31 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- '{{BaseURL}}/manager/html'`
new tomcat manager 2021-02-01 10:01:15 +00:00			`- '{{BaseURL}}/host-manager/html'`
BaseURL updates 2021-01-14 14:41:56 +00:00
Fixed default condition OR to AND in false-positives 2020-07-08 11:38:57 +00:00			`matchers-condition: and`
add tomcat manager disclosure (authenticated) 2020-06-18 02:27:31 +00:00			`matchers:`
			`- type: word`
			`words:`
Update and rename tomcat.yaml to public-tomcat-instance.yaml 2020-07-01 06:06:04 +00:00			`- Apache Tomcat`
add tomcat manager disclosure (authenticated) 2020-06-18 02:27:31 +00:00			`- type: status`
			`status:`
			`- 401`
Update and rename public-tomcat-instance.yaml to public-tomcat-manager.yaml Updating the name to better reflect what we're looking for. Updating the status matcher since some Tomcat manager instances don't require auth. 2021-01-13 23:28:48 +00:00			`- 200`
			`condition: or`